Before running the image or even when running as HotFunctions the runner should check if the image SHA has been changed and should pull the new one.